Deep Security Audit: Data Leak Analysis — Verified Findings (2026-05-13) #198

Deep Security Audit — Data Leak Analysis (2026-05-13)

Full audit of every outbound HTTP call, the sharing pipeline, LLM headers, remote config, MCP tools, and bundled web UI. Each critical claim was verified against source code.

⛔ Conditional Data Leaks (opt-in, but scope is significant)

1. Share system uploads prompts, responses, tool outputs, and code diffs — MEDIUM (opt-in)

Files: packages/opencode/src/share/share-next.ts, packages/opencode/src/share/session.ts

When a session is shared (manually or via share: "auto"), the following is uploaded in real-time to https://opncd.ai:

The SnapshotFileDiff type (packages/opencode/src/snapshot/index.ts:22–31) carries a unified diff patch string — changed lines, not full file contents. An earlier draft of this report incorrectly stated full file contents were sent; this has been corrected.

Auto-share triggers only if:

• share: "auto" in config, OR
• autoshare: true (deprecated), OR
• OPENCODE_AUTO_SHARE=1 env var

Default: OFF. There is no path where sharing happens without explicit opt-in.

2. opencode provider routes requests through opncd.ai — MEDIUM (opt-in)

File: packages/opencode/src/session/llm.ts:374–380

When the user configures the opencode provider (requires explicit apiKey from opencode.ai), all LLM requests are routed through opencode.ai servers with these extra headers:

x-opencode-project: <first git root commit hash>  ← pseudonymous project ID
x-opencode-session: <session UUID>
x-opencode-request: <message UUID>
x-opencode-client: cli|tui|desktop|...
User-Agent: opencode/<version>

This only affects users who explicitly configure provider.opencode.options.apiKey. Users running their own Anthropic/OpenAI/etc. keys are unaffected.

3. GitHub OIDC/PAT token forwarded to api.opencode.ai — MEDIUM (CI only)

File: packages/opencode/src/cli/cmd/github.ts:363,742

When running opencode github in GitHub Actions with use_github_token mode, a GitHub PAT or OIDC token is POSTed to https://api.opencode.ai/exchange_github_app_token to exchange for a GitHub App token. This is strictly a GitHub Actions CI workflow opt-in.

4. Web search queries sent to third-party services — LOW (tool invocation)

File: packages/opencode/src/tool/mcp-websearch.ts, packages/opencode/src/tool/websearch.ts

When the LLM invokes the web search tool (requires a permission prompt):

• Exa (mcp.exa.ai): receives the search query
• Parallel (search.parallel.ai): receives the search query plus the local session UUID and model name

The ctx.ask permission prompt should name these third-party recipients explicitly.

5. Remote config token forwarding (enterprise wellknown) — HIGH (enterprise only)

File: packages/opencode/src/config/config.ts:538–561

When a wellknown auth entry is configured, opencode:

1. Fetches ${url}/.well-known/opencode
2. Calls substituteWellKnownRemoteConfig() — resolves remote_config.url and remote_config.headers from the wellknown response
3. Makes a second fetch(remote.url, { headers: remote.headers }) — forwarding any headers the wellknown endpoint specifies

If the wellknown endpoint is compromised or malicious, it can direct the client to an attacker-controlled URL and inject arbitrary headers (including auth tokens) into that second request. This is an SSRF / token-forwarding risk in enterprise deployments only.

⚠️ Background calls (no user data, but automatic)

6. models.dev refreshes every 60 minutes — LOW

File: packages/opencode/src/provider/models.ts:105,186

On startup and every 60 minutes (Schedule.spaced("60 minutes")), opencode fetches https://models.dev/api.json to update the available model list.

Data sent: Only User-Agent: opencode/{channel}/{version}/{client} — reveals version, release channel, and client type. No prompts, no code, no credentials. Pure GET.

Disable: Not directly configurable; this is the model registry update mechanism.

7. Auto-update check on TUI startup — LOW

File: packages/opencode/src/cli/upgrade.ts, packages/opencode/src/installation/index.ts

On every TUI launch, opencode checks for a newer version by hitting npm/brew/GitHub/Chocolatey registries (GET-only). Reveals version, channel, and client type in User-Agent. No user data.

Disable: autoupdate: false in config or OPENCODE_DISABLE_AUTOUPDATE=1.

✅ Confirmed Safe

Recommendations

1. Disable auto-update pings: autoupdate: false in config or OPENCODE_DISABLE_AUTOUPDATE=1
2. Use your own provider API keys (Anthropic, OpenAI, etc.) — prompts go directly to the provider with no opencode.ai intermediary
3. Treat share: "auto" as high-risk — it uploads full prompts, responses, and code diffs in real-time to opncd.ai
4. Permission prompt for web search should name exa.ai / parallel.ai explicitly and note session ID is sent to Parallel
5. Enterprise wellknown config: validate that remote_config.url is on an expected domain before following it

Audit performed 2026-05-13. Sources: direct code inspection + automated deep-dive with Claude Opus.